Analysis
-
max time kernel
157s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
06-03-2022 00:56
Static task
static1
Behavioral task
behavioral1
Sample
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe
Resource
win10v2004-en-20220112
General
-
Target
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe
-
Size
92KB
-
MD5
b32f0abd4b50c15d6f8e938cd7ca68f0
-
SHA1
1c7bcc09f2fb2259d0d54e64cbee75ed2b2b7e32
-
SHA256
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c
-
SHA512
fdb299b552250b0ef1131fc1ad5d06d1a4860421329c3cb32afcc999ca264ff32bfbdb114d66e378fc32520aae508e0e1437ffba1f1620afc7859409ee3d045d
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe = "C:\\Windows\\System32\\6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe" 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-790714498-1549421491-1643397139-1000\desktop.ini 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\desktop.ini 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\desktop.ini 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe -
Drops file in System32 directory 1 IoCs
Processes:
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exedescription ioc process File created C:\Windows\System32\6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe -
Drops file in Program Files directory 64 IoCs
Processes:
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exedescription ioc process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBENDF98.CHM.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_wob.png.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\ui-strings.js.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\ui-strings.js.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign.png.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\MSSOAPR3.DLL.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\ui-strings.js.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-100.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adc_logo.png.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.DLL.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.exe.sig.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\ui-strings.js 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-24_contrast-white.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-24_altform-unplated.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-125_contrast-black.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-high.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\protect_poster.jpg.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\mobile_reader_logo.svg 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\LargeTile.scale-200.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msgrammar8.dll.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\en_US.dic.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\DemoNotebook.onepkg 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\ui-strings.js 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\SmallTile.scale-125.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-400.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-72_altform-lightunplated.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\ui-strings.js.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\nb.pak.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\RepairRequest.vsx.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\ui-strings.js 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-actions.jar.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\accessibility.properties.id-C285DD8F.[[email protected]].ROGER 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1520 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exepid process 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2372 vssvc.exe Token: SeRestorePrivilege 2372 vssvc.exe Token: SeAuditPrivilege 2372 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.execmd.exedescription pid process target process PID 3732 wrote to memory of 4036 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe cmd.exe PID 3732 wrote to memory of 4036 3732 6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe cmd.exe PID 4036 wrote to memory of 672 4036 cmd.exe mode.com PID 4036 wrote to memory of 672 4036 cmd.exe mode.com PID 4036 wrote to memory of 1520 4036 cmd.exe vssadmin.exe PID 4036 wrote to memory of 1520 4036 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe"C:\Users\Admin\AppData\Local\Temp\6140443e0c5dc2221b55241118a0e8d6f77da71e4c43bf0d06a77ba6eb28b64c.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:672
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1520
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372